join x509: certificate has expired or is not yet valid

Question

While joining the centos 7 node to cluster 1.9.0, kubeadm join command gives this error message.

Failed to request cluster info, will try again: [Get https://10.10.10.10:6443/api/v1/namespaces/kube-public/configmaps/cluster-info: x509: certificate has expired or is not yet valid]

I got this message last night, this morning when run this command it worked. I removed and trying to create the cluster this morning, again its giving same error message.

kubeadm join --token f115fe.f0eea05182abe63a 10.10.10.10:6443 --discovery-token-ca-cert-hash sha256:48d4dc90a08ff73a0cfc63e30a313aaf1903fd51da8f9ce4cc79f95ce529b8d1

[discovery] Created cluster-info discovery client, requesting info from "https://10.10.10.10:6443"
[discovery] Requesting info from "https://10.10.10.10:6443" again to validate TLS against the pinned public key
[discovery] Failed to request cluster info, will try again: [Get https://10.10.10.10:6443/api/v1/namespaces/kube-public/configmaps/cluster-info: x509: certificate has expired or is not yet valid]
[discovery] Failed to request cluster info, will try again: [Get https://10.10.10.10:6443/api/v1/namespaces/kube-public/configmaps/cluster-info: x509: certificate has expired or is not yet valid]

How to resolve this error message?

Solution 1

The root cause of the issue is my node didn't have the correct time. after configuring NTP service node was able to join the master.

Solution 2

I had the same problem after installed a docker repository with a new certificate. When connecting from the a command line using docker I was able to push and pull the image but kubernetes generated an error 'x509: certificate has expired or is not yet valid'. When I connected to the minikube VM 'ssh minikube' and entered 'date' I noticed the clock was several hours off. When I manually set the date in the minikube VM the problem was fixed.

Comments

[manish sehgal]

I had different ntp source on master and worker node. Once I sync'd both master and worker to same ntp source then it worked.